Skip to content

Security module for php7 - Killing bugclasses and virtual-patching the rest!

License

Notifications You must be signed in to change notification settings

avkarenow/snuffleupagus

This branch is 1 commit ahead of, 611 commits behind jvoisin/snuffleupagus:master.

Folders and files

NameName
Last commit message
Last commit date

Latest commit

80bd1c7 · Feb 11, 2019
Jan 16, 2019
Jan 16, 2019
Jan 22, 2019
Dec 15, 2018
Sep 13, 2018
Feb 11, 2019
Feb 27, 2018
Oct 9, 2017
Jan 14, 2019
Sep 13, 2018
Jan 16, 2019
Jan 18, 2018
Jul 19, 2018
Sep 20, 2017
Jan 12, 2019
Jul 24, 2018
Jan 7, 2019

Repository files navigation


Snuffleupagus' logo
Snuffleupagus

Security module for php7 - Killing bugclasses and virtual-patching the rest!

Travis-ci gitlab pipeline testing _all_ distributions Coverity CII Best Practises readthedocs.org coveralls twitter

Key FeaturesDownloadExamplesDocumentationLicenseThanks

Snuffleupagus is a PHP 7+ module designed to drastically raise the cost of attacks against websites, by killing entire bug classes. It also provides a powerful virtual-patching system, allowing administrator to fix specific vulnerabilities and audit suspicious behaviours without having to touch the PHP code.

Key Features

  • Close to zero performance impact
  • Powerful yet simple to write virtual-patching rules
  • Killing several classes of vulnerabilities
  • Several hardening features
    • Automatic secure and samesite flag for cookies
    • Bundled set of rules to detect post-compromissions behaviours
    • Global strict mode and type-juggling prevention
    • Whitelisting of stream wrappers
    • Preventing writeable files execution
    • Whitelist/blacklist for eval
    • Enforcing TLS certificate validation when using curl
    • Request dumping capability
  • A relatively sane codebase:

Download

We've got a download page, where you can find packages for your distribution, but you can of course just git clone this repo, or check the releases on github.

Examples

We're providing various example rules, that are looking like this:

# Harden the `chmod` function
sp.disable_function.function("chmod").param("mode").value_r("^[0-9]{2}[67]$").drop();

# Mitigate command injection in `system`
sp.disable_function.function("system").param("command").value_r("[$|;&`\\n]").drop();

Upon violation of a rule, you should see lines like this in your logs:

[snuffleupagus][0.0.0.0][disabled_function][drop] The execution has been aborted in /var/www/index.php:2, because the return value (0) of the function 'strpos' matched a rule.

Documentation

We've got a comprehensive website with all the documentation that you could possibly wish for. You can of course build it yourself.

Thanks

Many thanks to the Suhosin project for being a huge source of inspiration, and to all our contributors.

About

Security module for php7 - Killing bugclasses and virtual-patching the rest!

Resources

License

Stars

Watchers

Forks

Packages

No packages published

Languages

  • C 94.7%
  • PHP 1.5%
  • Makefile 1.1%
  • Shell 1.0%
  • M4 0.8%
  • Python 0.5%
  • Other 0.4%